The Helsinki Court of Appeal has sentenced Julius Aleksanteri Kivimäki to 6 years and 11 months in prison, upholding the district court's verdict regarding the crimes linked to the Vastaamo data breach. However, the appellate court increased the sentence by 8 months, recognizing the severity of Kivimäki's actions as a deliberate criminal enterprise that impacted a particularly vulnerable group of individuals, causing significant suffering. The court noted that Kivimäki's motivations were primarily driven by a substantial financial gain from his actions, stating that the maximum penalty for the data breach would typically be around 7 years in prison.

Despite the serious nature of the offenses, the appellate court took into account mitigating factors, namely Kivimäki's agreements for compensation with many of the victims, which contributed to a slightly reduced sentence from what could have been imposed. Kivimäki had initially awaited his sentence as a free person, but the court found that there were no special grounds to justify preemptive detention. This case underscores the ongoing challenges of cybersecurity and the potential legal consequences of data breaches, particularly as they affect personal privacy and the welfare of vulnerable populations.